Well, there's not really any way someone could execute this attack. Receipts aren't logically grouped by reports based on someone's identity... They said it was part of an experiment and only included a small group of free users (if you're not paying, then YOU'RE the product) plus their employees.